Select statement with or operator

Question

Let say if i've database row settings [id,user,pass,sos]

I've the following mysql statement

$username and $password could be anything whatever

$query = mysql_query ("SELECT * FROM `settings` WHERE user='$username' AND pass='$password'")

i want to say

SELECT * FROM `settings` WHERE user='$username' AND pass='$password' or sos=$username and sos=$password

so my question is how to use or within select statement

like i wanna say

user='$username'
pass='$password'
or
sos = both $username and $password

Thanks for helping

what is sos? how can you have one filed with 2 different value? — AJP, Jan 27 '12 at 19:43
this is just an example for simplicity then i'll apply it for my case :) ~thanks for your comment — Reham Fahmy, Jan 27 '12 at 19:55

score 3 · Accepted Answer · edited May 23 '17 at 12:03

You need to use some brackets to make sure you are correctly matching on related username/password pairs:

SELECT * 
FROM `settings` 
WHERE (user='$username' AND pass='$password') 
    or (sos='$username' and sos='$password')

However, you really need to use parameterized queries as the above is subject to SQL injection attack. See here for some examples on how to do this:

score 1 · Answer 2 · answered Jan 27 '12 at 19:39

1

You could do

SELECT * 
FROM `settings` 
WHERE (user='$username' AND pass='$password') or (sos='$username' and sos='$password')

answered Jan 27 '12 at 19:39

Nicola Peluchetti

score 1 · Answer 3 · answered Jan 27 '12 at 19:39

1

You just need some parenthetical groups. I added single quotes in the second group, where you were initially missing them.

SELECT * 
FROM `settings`
WHERE 
  (user='$username' AND pass='$password')
  OR (sos='$username' AND sos='$password')

answered Jan 27 '12 at 19:39

Michael Berkowski

score 1 · Answer 4 · answered Jan 27 '12 at 19:40

1

Use parentheses:

SELECT * 
FROM `settings` 
WHERE 
   (user='$username' AND pass='$password')
   OR
   (sos='$username' AND sos='$password')

answered Jan 27 '12 at 19:40

bfavaretto

score 1 · Answer 5 · answered Jan 27 '12 at 19:41

1

I think you need parenthesis

SELECT * FROM `settings` WHERE (user='$username' AND pass='$password') or (sos=$username and sos=$password)

answered Jan 27 '12 at 19:41

Gus

score 1 · Answer 6 · answered Jan 27 '12 at 19:43

1

Does it not work exactly like that? I would write

WHERE (user = '$username' AND pass = '$password')
OR ('$username' = '$password' AND sos = '$username');

answered Jan 27 '12 at 19:43

Borodin

6 Answers6